CVEvulnerability

CVE-2014-2966

5.0 MEDIUM Published 2014-07-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-07-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-20, CWE-264

Description

The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism.

Affected configurations

• caucho resin (<= 4.0.39) • caucho resin 4.0.36 • caucho resin 4.0.37 • caucho resin 4.0.38

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References